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internal contents wherein an external memory (131) for storing external contents 
is detachably mounted on said processing apparatus, for performing processing 
according to the internal contents stored in said internal memory (112) and the 
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decides validity of the external contents stored in said external memory (131). 
The external contents stored in said external memory (131) involve original check 
result information (E) representative of a check result associated with validity of 
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accordance with a predetermined check algorithm to obtain a check result. The 
check result obtained is compared with a check result represented by the original 
check result information (E) stored in a storage position indicated by the original 
check result position information (A) to decide the validity of the external contents 
stored in said external memory (131). 

Data supplied from the esp@cenet database - Worldwide 



Courtesy of http://v3.espacenet.com 



This Patent PDF Generated by Patent Fetcher(TM), a service of Stroke of Colon Inc. 



(19) 



J 



Europfiisches Patentamt 
European Patent Office 
Office europeen des brevets 



(12) 



(43) Date of publication: 

02.01.2002 Bulletin 2002/01 



(n) EP1 168172 A2 

EUROPEAN PATENT APPLICATION 

(51) Int CI 7; G06F 11/10 



(21) Application number 00311115.0 

(22) Date of filing: 13.12.2000 



(84) Designated Contracting States: 

AT BE CH CY DE DK ES Fl FR GB GR IE IT LI LU 
MCNLPTSETR 
Designated Extension States: 
AL LT LV MK RO SI 

(30) Priority: 29.06.2000 JP 2000196476 

(71) Applicant: FUJITSU LIMITED 

Kawasakl-shl, Kanagawa 211-8588 (JP) 



(72) Inventors: 

• Kawasaki, Yusuke, c/o Fujitsu Limited 
Kawasakl-shl, Kanagawa 211-8588 (JP) 

• Sakural, Hlroshi, c/o Fujitsu Limited 
Kawasaki-shi, Kanagawa 211-8588 (JP) 

• Hashimoto, Shlgeru, c/o Fujitsu Limited 
Kawasaki-shi, Kanagawa 211-8588 (JP) 

(74) Representative: Hitching, Peter Matthew et al 
Haseltine Lake & Co., Imperial House, 15-19 
Kingsway 

London WC2B 6UD (GB) 



(54) Contents check method, contents renewal method and processing apparatus 



(57) Recessing apparatus (100) is provided having 
an internal memory (112) storing internal contents 
wherein an external memory (131) for storing external 
contents is detachably mounted on said processing ap- 
paratus, for performing processing according to the in- 
ternal contents stored in said internal memory (112) and 
the external contents stored in said external memory 
(131), a contents check method decides validity of the 
external contents stored in said external memory (131). 
The external contents stored in said external memory 
(131) involve original check result information (E) rep- 



resentative of a check result associated with validity of 
the external contents and original check result position 
information (A) representative of a storage position of 
the original check result information (E). The external 
contents stored in said external memory (131) is 
checked in accordance with a predetermined check al- 
gorithm to obtain a check result. The check result ob- 
tained is compared with a check result represented by 
the original check result information (E) stored in a stor- 
age position indicated by the original check result posi- 
tion information (A) to decide the validity of the external 
contents stored in said external memory (131). 
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Description 

[0001] The present invention relates to a processing 
apparatus having a memory for storing contents, for ex- 
ample, a processing apparatus having an internal mem- 
ory for storing internal contents consisting of programs 
and the like, to which an external memory for storing 
external contents such as programs and data is detach- 
ably mounted, said processing apparatus being for per- 
forming a processing according to the internal contents 
stored in the internal memory and the external contents 
stored in the external memory, a contents check method 
of determining validity of the external contents stored in 
the external memory in the processing apparatus, and 
a contents renewal method of renewing a module which 
is a part of the external contents stored in the external 
memory in the processing apparatus. 
[0002] Hitherto, in an apparatus for performing 
processing using LSI chips including CPU, there has 
been previously considered an arrangement in which an 
internal memory such as ROM and the like is loaded in 
an LSI chip so that a program, which is universal or less 
likely to require renewal (updating), is stored in the in- 
ternal memory, and an external memory (for example, 
ROM and flash ROM) is detachably mounted on the LSI 
chip so that after forwarding of the apparatus, an appli- 
cation program and various sorts of data can be rewrit- 
ten, and the application program and various sorts of 
data are stored in the external memory so as to be proc- 
essed. 

[0003] However, the apparatus as mentioned above 
is associated with such a problem that when contents 
such as programs and data stored in the external mem- 
ory are unfairly rewritten, or when the external memory 
is replaced by another memory storing unfair contents, 
a malicious program is executed, or alternatively even 
if the program is proper per se, an erroneous processing 
is performed in accordance with a malicious data. 
[0004] For example, in the event that the external 
memory (ROM) of the above-mentioned apparatus 
loaded on a financial terminal apparatus is unfairly ob- 
tained to read a program stored in the external memory 
through the reverse engineering, and a program code 
unfairly outputting or storing an entered personal iden- 
tification number is added in a personal identification 
number input module in the program so as to be stored 
in the same type of ROM, and then the ROM is returned 
to the financial terminal apparatus, it is possible to steal 
the personal identification number without being noticed 
by a user. 

[0005] In view of the foregoing, it is desirable to pro- 
vide a processing apparatus capable of avoiding an ex- 
ecution of an unfair program and an execution of an un- 
fair processing due to an unfair data, a contents check 
method of checking validity of contents stored in a mem- 
ory, and a contents renewal method capable of prevent- 
ing an unfair renewal of contents stored in a memory. 
[0006] According to an embodiment of a first aspect 



of the present invention, there is provided a contents 
check method in a processing apparatus having a mem- 
ory storing contents for performing a processing accord- 
ing to the contents stored in said memory, the contents 

5 check method deciding validity of the contents stored in 
said memory, 

wherein the contents stored in said memory in- 
volve original check result information representative of 
a check result associated with validity of the contents 

10 and original check result position information represent- 
ative of a storage position of the original check result 
information, said contents check method comprising: 

a check step of checking the contents stored in said 
15 memory in accordance with a predetermined check 
algorithm to obtain a check result; and 
a comparison step of comparing the check result 
obtained by said check step with a check result rep- 
resented by the original check result information 
20 stored in a storage position indicated by the original 
check result position information to decide validity 
of the contents stored in said memory. 

[0007] With such a contents check method embody- 
25 ing the present invention as mentioned above, the con- 
tents stored in the memory involve not only the original 
check result information, but also the original check re- 
sult position information. This feature makes it possible 
to reduce a possibility that the original check result in- 
30 formation is unfairly known by a third person, as com- 
pared with a case where the original check result infor- 
mation is stored in a fixed address. Further, it is possible 
to properly decide validity of the contents stored in the 
memory and thereby effectively preventing unfair pro- 
as gram and data from being entered forcibly. 

[0008] According to an embodiment of a second as- 
pect of the present invention, there is provided a con- 
tents check method in a processing apparatus having 
an Internal memory storing internal contents wherein an 
*o external memory for storing external contents is detach- 
ably mounted on said processing apparatus, for per- 
forming a processing according to the internal contents 
stored in said internal memory and the external contents 
stored in said external memory, the contents check 
45 method deciding validity of the external contents stored 
in said external memory, 

wherein the external contents stored in said exter- 
nal memory involve original check result information 
representative of a check result associated with validity 
50 of the external contents and original check result posi- 
tion information representative of a storage position of 
the original check result information, said contents 
check method comprising: 

55 a check step of checking the external contents 
stored in said external memory in accordance with 
a predetermined check algorithm to obtain a check 
result; and 
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a comparison step of comparing the check result 
obtained by said check step with a check result rep- 
resented by the original check result information 
stored in a storage position indicated by the original 
check result position information to decide validity 
of the external contents stored in said external 
memory. 

[0009] With such a contents check method embody- 
ing the present invention as mentioned above, as men- 
tioned above, the contents stored in the memory involve 
not only the original check result information, but also 
the original check result position information. This fea- 
ture makes it possible to reduce a possibility that the 
original check result information is unfairly known by a 
third person, as compared with a case where the original 
check result information is stored in a fixed address. Fur- 
ther, it is possible to property decide validity of the con- 
tents stored in the memory and thereby effectively pre- 
venting unfair program and data from being entered for- 
cibly. 

[0010] With such a contents check method embody- 
ing the present invention as mentioned above, it is pref- 
erable that the external contents stored in said external 
memory involve the original check result information 
and the original check result position information at least 
one of which is encoded, said contents check method 
further comprising: 

a decoding step of decoding one encoded of the 
original check result information and the original 
check result position information. 

[001 1 ] This feature makes it possible to further reduce 
a possibility that the original check result information 
and the storage place are unfairly known by a third per- 
son. 

[0012] With such a contents check method embody- 
ing the present invention as mentioned above, it is pref- 
erable that the external contents stored in said external 
memory involve check area designation information, 
and 

said check step checks an check area designated 
by the check area designation information of the exter- 
nal contents stored in said external memory. 
[0013] This feature makes it possible to properly de- 
cide validity of contents stored in the external memory 
upon ensuring a rewritable area on the external memory 
by a user. 

[0014] In this case, it is preferable that the external 
contents stored in said external memory involve the 
check area designation information which is encoded, 
said contents check method further comprising: 

a decoding step of decoding the encoded check ar- 
ea designation information. 

[0015] This feature makes it possible to prevent unfair 



contents from being entered forcibly, since it is difficult 
to identify the check area. 

[0016] According to an embodiment of a third aspect 
of the present invention, there is provided a contents 

s renewal method in a processing apparatus having a 
memory storing contents for performing a processing 
according to the contents stored in said memory, the 
contents renewal method renewing a module to be re- 
newed, which is part of the contents stored in said mem- 

10 ory, into a new renewal module, 

wherein the contents stored in said memory in- 
volve original check result information representative of 
a check result associated with validity of the contents 
and original module check result information represent- 

'5 ative of a check result associated with validity of the re- 
newal module, said contents renewal method compris- 
ing: 

a module check step of checking the renewal mod- 

20 ule in accordance with a predetermined check al- 
gorithm to obtain a check result; 
a comparison step of comparing the check result 
obtained by said module check step with a check 
result represented by the original module check re- 

25 suit information involved in the renewal module to 
decide validity of the renewal module; 
a correction data producing step of producing cor- 
rection data in such a manner that a check result, 
in a case where the contents stored in said memory 

30 after the module to be renewed of the contents 
stored in said memory is renewed into the renewal 
module involving correction data is checked in ac- 
cordance with a predetermined algorithm, is coinci- 
dent with the check result represented by the orig- 

35 inal check result information involved in the con- 
tents; and 

a module renewal step of renewing the module to 
be renewed of the contents stored in said memory 
into the renewal module involving the correction da- 
40 ta produced in said correction data producing step 
in a case where said module check step decides 
that the renewal module is proper. 

[0017] With such a program renewal method embod- 
45 ying the present invention as mentioned above, the 
combination of the module check step and the module 
renewal step makes it possible to decide validity of the 
renewal module. 

[0018] When the module to be renewed is replaced 
so by a renewal module, the check result of the contents is 
changed. To cope with this, it has been previously con- 
sidered that when the module to be renewed is renewed 
into a renewal module, the original check result informa- 
tion of the contents stored in the memory is rewritten 
55 when the module to be renewed is renewed into the re- 
newal module. However, such a renewal needs a rewrit- 
ing of the original check result information every renew- 
al. This is associated with a high possibility that a stor- 
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age address of the original check result Information is 
known by an unfair observer of the access of the con- 
tents. 

[0019] On the contrary, according to an embodiment 
of the present invention, correction data is produced in 
the correction data producing step, and the correction 
data is written together with the renewal module on the 
memory. Thus, there is no need to rewrite the original 
check result information of the contents which are stored 
in the memory, and thereby greatly reduce danger that 
the storage place of the original check result information 
is unfairly known. 

[0020] According to an embodiment of a fourth aspect 
of the present invention, there is provided a contents 
renewal method in a processing apparatus having an 
internal memory storing internal contents wherein an ex- 
ternal memory for storing external contents is detacha- 
bly mounted on said processing apparatus, for perform- 
ing a processing according to the internal contents 
stored in said internal memory and the external contents 
stored in said external memory, the contents renewal 
method renewing a module to be renewed, which is part 
of the contents stored in said external memory, into a 
new renewal module, 

wherein the contents stored in said external mem- 
ory involve original check result information represent- 
ative of a check result associated with validity of the ex- 
ternal contents and original module check result infor- 
mation representative of a check result associated with 
validity of the renewal module, said contents renewal 
method comprising: 

a module check step of checking the renewal mod- 
ule in accordance with a predetermined check al- 
gorithm to obtain a check result; 
a comparison step of comparing the check result 
obtained by said module check step with a check 
result represented by the original module check re- 
sult information involved in the renewal module to 
decide validity of the renewal module; 
a correction data producing step of producing cor- 
rection data in such a manner that a check result, 
in a case where the external contents stored in said 
external memory after the module to be renewed of 
the external contents stored in said external mem- 
ory is renewed into the renewal module Involving 
correction data is checked in accordance with a pre- 
determined algorithm, is coincident with the check 
result represented by the original check result infor- 
mation involved in the external contents; and 
a module renewal step of renewing the module to 
be renewed of the external contents stored in said 
external memory into the renewal module involving 
the correction data produced in said correction data 
producing step in a case where said module check 
step decides that the renewal module is proper. 

[0021 ] With such a contents renewal method embod- 



ying the present invention as mentioned above, the 
combination of the module check step and the module 
renewal step makes it possible to decide validity of the 
renewal module. 

5 [0022] When the module to be renewed is replaced 
by a renewal module, the check result of the external 
contents is changed. To cope with this, it has been pre- 
viously considered that when the module to be renewed 
Is renewed into a renewal module, the original check re- 

10 suit information of the external contents stored in the 
external memory is rewritten when the module to be re- 
newed is renewed into the renewal module. However, 
such a renewal needs a rewriting of the original check 
result information every renewal. This is associated with 

« a high possibility that a storage address of the original 
check result information is known by an unfair observer 
of the access of the contents. 
[0023] On the contrary, according to an embodiment 
of the present invention, correction data is produced in 

20 the correction data producing step, and the correction 
data is written together with the renewal module on the 
external memory. Thus, there is no need to rewrite the 
original check result information of the external contents 
which are stored in the external memory, and thereby 

25 greatly reduce danger that the storage place of the orig- 
inal check result information is unfairly known. 
[0024] With such a contents renewal method embod- 
ying the present invention as mentioned above, it is pref- 
erable that the renewal module involves the original 

30 module check result information which is encoded, said 
contents renewal method further comprising: 

a decoding step of decoding the encoded original 
module check result information. 

35 

[0025] This feature makes it possible to effectively 
prevent an unfair module from being entered forcibly. 
[0026] In this case, it is preferable that the external 
contents stored in said external memory involve a key 
40 for decoding the encoded original module check result 
information, and 

said decoding step decodes the encoded original 
module check result information by said key. 
[0027] Further, it is preferable that the external con- 
45 tents stored in said external memory involve the key 
which is encoded, 

said decoding step decodes the encoded original 
module check result information with the key which is 
read from said external memory and is decoded. 
so [0028] This feature makes it further difficult that the 
unfair module enters forcibly. 
[0029] According to an embodiment of a fifth aspect 
of the present invention, there is provided a first 
processing apparatus having a memory storing con- 
55 tents for performing a processing according to the con- 
tents stored in said memory, 

wherein the contents stored in said memory in- 
volve original check result Information representative of 
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a check result associated with validity of the contents 
and original check result position information represent- 
ative of a storage position of the original check result 
information, said processing apparatus comprising: 

a check section for checking the contents stored in 
said memory in accordance with a predetermined 
check algorithm to obtain a check result; and 
a comparison section for comparing the check re- 
sult obtained by said check section with a check re- 
sult represented by the original check result Infor- 
mation stored in a storage position indicated by the 
original check result position information to decide 
validity of the contents stored in said memory. 

[0030] According to an embodiment of a sixth aspect 
of the present invention, there is provided a first 
processing apparatus having an internal memory stor- 
ing internal contents wherein an external memory for 
storing external contents is detachably mounted on said 
processing apparatus, for performing a processing ac- 
cording to the internal contents stored in said internal 
memory and the external contents stored in said exter- 
nal memory, 

wherein the external contents stored in said exter- 
nal memory involve original check result information 
representative of a check result associated with validity 
of the external contents and original check result posi- 
tion information representative of a storage position of 
the original check result information, said processing 
apparatus comprising: 

a check section for checking the external contents 
stored in said external memory in accordance with 
a predetermined check algorithm to obtain a check 
result; and 

a comparison section for comparing the check re- 
sult obtained by said check section with a check re- 
sult represented by the original check result infor- 
mation stored in a storage position indicated by the 
original check result position information to decide 
validity of the external contents stored in said exter- 
nal memory. 

[0031] With such a first processing apparatus embod- 
ying the present invention as mentioned above, it is pref- 
erable that the external contents stored in said external 
memory involve the original check result information 
and the original check result position information at least 
one of which is encoded, said processing apparatus fur- 
ther comprising: 

a decoding section for decoding one encoded of the 
original check result Information and the original 
check result position information. 

[0032] Further, with such a first processing apparatus 
embodying the present invention as mentioned above, 



it is preferable that the external contents stored in said 
external memory involve check area designation infor- 
mation, and 

said check section checks an check area desig- 

5 nated by the check area designation information of the 
external contents stored in said external memory. 
[0033] In this case, it is preferable that the external 
contents stored in said external memory involve the 
check area designation information which is encoded, 

10 said processing apparatus further comprising: 

a decoding section for decoding the encoded 
check area designation information. 
[0034] According to an embodiment of a seventh as- 
pect of the present invention, there is provided a second 

15 processing apparatus having a memory storing con- 
tents for performing a processing according to the con- 
tents stored in said memory, 

wherein the contents stored in said memory in- 
volve original check result information representative of 

20 a check result associated with validity of the contents, 
said processing apparatus comprising: 

a renewal module obtaining section for obtaining a 
renewal module involving original module check re- 

25 suit information representative of a check result as- 
sociated with validity of the renewal module, said 
renewal module being to be substituted for a mod- 
ule to be renewed which is part of the contents 
stored in said memory; 

30 a module check section for checking the renewal 
module obtained in said renewal module obtaining 
section in accordance with a predetermined check 
algorithm to obtain a check result; 
a comparison section for comparing the check re- 

35 suit obtained by said module check step with a 
check result represented by the original module 
check result information involved in the renewal 
module to decide validity of the renewal module; 
a correction data producing section for producing 

40 correction data in such a manner that a check result, 
in a case where the contents stored in said memory 
after the module to be renewed of the contents 
stored in said memory is renewed into the renewal 
module involving correction data is checked in ac- 

45 cordance with a predetermined algorithm, is coinci- 
dent with the check result represented by the orig- 
inal check result information involved in the con- 
tents; and 

a module renewal section for renewing the module 
so to be renewed of the contents stored in said mem- 
ory into the renewal module involving the correction 
data produced in said correction data producing 
section in a case where said module check step de- 
cides that the renewal module is proper. 

55 

[0035] According to an embodiment of an eighth as- 
pect of the present invention, there is provided a second 
processing apparatus having an internal memory stor- 
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ing internal contents wherein an external memory for 
storing external contents is detachably mounted on said 
processing apparatus, for performing a processing ac- 
cording to the internal contents stored in said internal 
memory and the external contents stored in said exter- 
nal memory, 

wherein the external contents stored in said exter- 
nal memory involve original check result Information 
representative of a check result associated with validity 
of the external contents, said processing apparatus 
comprising: 

a renewal module obtaining section for obtaining a 
renewal module involving original module check re- 
sult information representative of a check result as- 
sociated with validity of the renewal module, said 
renewal module being to be substituted for a mod- 
ule to be renewed which is part of the external con- 
tents stored in said memory; 
a module check section for checking the renewal 
module in accordance with a predetermined check 
algorithm to obtain a check result; 
a comparison section for comparing the check re- 
sult obtained by said module check section with a 
check result represented by the original module 
check result information involved in the renewal 
module to decide validity of the renewal module; 
a correction data producing section for producing 
correction data in such a manner that a check result, 
in a case where the external contents stored in said 
external memory after the module to be renewed of 
the external contents stored in said external mem- 
ory is renewed into the renewal module involving 
correction data is checked in accordance with a pre- 
determined algorithm, is coincident with the check 
result represented by the original check result infor- 
mation involved in the external contents; and 
a module renewal section for renewing the module 
to be renewed of the external contents stored in said 
external memory into the renewal module involving 
the correction data produced in said correction data 
producing step in a case where said module check 
step decides that the renewal module is proper. 

[0036] With such a second processing apparatus em- 
bodying the present invention as mentioned above, it is 
preferable that the renewal module involves the original 
module check result information which is encoded, said 
processing apparatus further comprising; 

a decoding section for decoding the encoded orig- 
inal module check result information. 

[0037] In this case, it is preferable that the externa! 
contents stored in said external memory involve a key 
for decoding the encoded original module check result 
information, and 

said decoding section decodes the encoded orig- 



inal module check result information by said key. 
[0038] Further, in this case, it is preferable that the ex- 
ternal contents stored in said external memory involve 
the key which is encoded, 
5 said decoding section decodes the encoded orig- 
inal module check result information with the key which 
is read from said external memory and is decoded. 
[0039] Reference will now be made, by way of exam- 
ple, to the accompanying drawings, in which: 

10 

Fig. 1 is a hardware structural view of a processing 
apparatus according to an embodiment of the 
present invention. 

Fig. 2 is a view showing a memory map of an exter- 
'5 nal program when the external program is down- 
loaded in its entirety from a host system. 
Fig. 3 is a flowchart useful for understanding a pro- 
gram check program to be executed in CPU when 
a power supply of the apparatus turns on. 
20 Fig. 4 is a view showing a handling of a renewal 
module downloaded from a host system, and a 
memory map of an external program renewed by 
the renewal module. 

Fig. 5 is a flowchart useful for understanding a mod- 
25 ule renewal program. 

[0040] Embodiments of the present invention will be 
described with reference to the accompanying draw- 
ings. 

30 [0041] Fig. 1 is a hardware structural view of a 
processing apparatus according to an embodiment of 
the present invention. A processing apparatus accord- 
ing to an embodiment of the present Invention compris- 
es a hardware shown in Fig. 1 and a program to be ex- 

35 ecutedinCPU. 

[0042] A processing apparatus 1 00 shown in Fig. 1 
comprises a portion mounted inside an LSI chip 110 an 
a portion detachably mounted outside the LSI chip 1 1 0. 
Inside the LSI chip 1 1 0, there is provided a CPU 1 1 1 for 

40 carrying out a program, ROM 112 forstoring an internal 
program to be executed in the CPU 111 , and a commu- 
nication interface 113 for carrying out communication 
with a host system. Those are mutually connected with 
one another through a bus 1 20 so as to be able to com- 

45 municate with each other. Inside the LSI chip 110, there 
Is provided a bus interface 1 1 4 connected to the bus 1 20 
which is extended via the bus interface 1 14 to the exte- 
rior of the LSI chip 110. A portion 120a extended to the 
exterior of the LSI chip 1 1 0 of the bus 1 20 is connected 

so to a flash ROM 131 and a RAM 132. 

[0043] Incidentally, while the LSI chip 110 includes 
further various sorts of elements, those are unneces- 
sary for the explanation of the present embodiment. 
Thus, the illustration and the explanation will be omitted. 

55 [0044] The flash ROM 131 stores therein an external 
program which is executed by the CPU 111 via the bus 
interface 1 1 4. The RAM 1 32 is used as a work area when 
a program is executed, and also used as a temporal 
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storage for a renewal module which will be explained 
hereinafter. 

[0045] ROM 1 12, which is provided inside the LSI chip 
1 1 0, stores an OS (operation system) and an application 
program which needs to be rewritten. On the other hand, 
the flash ROM 1 31 stores an application program an ap- 
plication program which is to be rewritten as the occa- 
sion demands. 

[0046] Hereinafter, there will be explained the present 
embodiment in such a way that situations are divided 
into two cases one of which is directed to a case where 
an external program, which is to be stored in the flash 
ROM 131 , is downloaded in its entirety from a host sys- 
tem, and another is directed to a case where an external 
program is already stores in the flash ROM 1 31 , and a 
program segment (a renewal module) for rewriting part 
(a module to be renewed) of the external program is 
downloaded from a host system. 
[0047] Fig. 2 is a view showing a memory map of an 
external program when the externa! program is down- 
loaded in its entirety from a host system. 
[0048] When the external program is downloaded in 
its entirety from a host system, the external program is 
taken into the inside of the apparatus through the com- 
munication interface 113 shown in Fig. 1 and is stored 
in the flash ROM 131. 

[0049] The externa! program stored in the flash ROM 
131 consists of, as shown in Fig. 2, a header, secret 
code position information (it happens that this is noted 
as 'A'), program area information (it happens that this is 
noted as 'B'), a program code, a user code which is lo- 
cated in an area of the program code, a user secret key, 
a ROM check result, and a user data area. 
[0050] The "header" stores therein information con- 
cerning a system constitution of the processing appara- 
tus according to the present embodiment. This part is 
unnecessary for the aspect of the processing apparatus 
according to the present embodiment, and thus redun- 
dant explanation will be omitted. 
[0051 ] The "secret code position information n and the 
"program area information" are stored in predetermined 
addresses of the external memory, respectively. The 
"secret code position information" indicates storage ad- 
dresses for the "user code", the °user secret key" and 
the "ROM check result". The "program area information" 
indicates the final address of the program code. 
[0052] The "program code" is a portion which is exe- 
cuted by the COU 1 1 1 and is located in the area thereof. 
The "user code" indicates information for identifying a 
user of the processing apparatus. The "user secret key" 
indicates information for a key used in decoding which 
will be described later. The "ROM check result" indicates 
information representative of a proper check result in the 
event that when the external program shown in Fig. 2 is 
a proper external program, the external program is 
checked in accordance with a predetermined check al- 
gorithm. As will be explained later, the external program 
shown in Fig. 2 is checked, and the check result is re- 



ferred to the "ROM check result" described in the exter- 
nal program. When both the check results are coincident 
with each other, it is decided that the external program 
is proper. To check the external program, a check is per- 
s formed on an area from the top of the "header" to the 
end of the program code Indicated by the "program area 
information". 

[0053] The "user data area" is an area which is rewri- 
table by a user of the processing apparatus, according 

10 to the processing apparatus, validity of the external pro- 
gram stored in the flash ROM 131 (cf. Fig. 1) is checked 
whenever a power supply of the processing apparatus 
turns on. Therefore, an inclusion of the user data area 
into an object of a check brings about a result of an er- 

15 roneous decision when a check is performed after the 
user data area is rewritten. 

[0054] For this reason, according to the present em- 
bodiment, the user data area is excluded from an object 
of a check. This feature makes it possible to perform a 
20 data writing into the user data area. 

[0055] Here, of the memory map shown in Fig. 2, A: 
secret code position information, B: program area infor- 
mation, D: a user secret key, and E: a ROM check result 
are embedded in the external program in the form that 
25 they are encoded. 

[0056] According to the present embodiment, validity 
of the external program stored in the flash ROM 131 is 
checked whenever the power supply of the processing 
apparatus turns on. The reason why this is to do so is 
30 that there is a possibility that when the power supply of 
the processing apparatus turns off, the flash ROM 131 
is replaced by another flash ROM storing an improper 
program. 

[0057] Fig. 3 is a flowchart useful for understanding a 
35 program check program to be executed in CPU 111 
when a power supply of the apparatus turns on. This 
program check program is stored in the ROM 112 pro- 
vided on the LSI chip 110 shown in Fig. 1. The program 
check program shown in Fig. 3 is concerned with an em- 
40 bodiment of a program check method according to the 
present invention, and the combination of the program 
check program shown in Fig. 3 with the hardware shown 
in Fig. 1 corresponds to an embodiment of the first 
processing apparatus of the present invention. 
45 [0058] Execution of the program shown in Fig. 3 per- 
forms a check of validity of the external program of the 
structure shown in Fig. 3, which is stored in the flash 
ROM 131. 

[0059] When the execution of the program shown in 
50 Fig. 3 is initiated, a read address of the flash ROM 131 
is set up (step a1 ). The read address is first set up for a 
first address of the header in the memory map shown 
in Fig. 2, and then set up for the subsequent addresses 
sequentially incremented one by one step. 
55 [0060] Next, contents of the read address are read out 
(step a2), a check as to the contents thus read out is 
performed (step a3). The check in the step a3 involves 
an integration of checks of read out contents while steps 
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a1 to aB are repeated. According to the check in the step 
a3, in the event that it is decided that the external pro- 
gram is a proper externa! program through a result of 
integration of the checks of read out contents when it is 
decided that the check is finally performed up to the ter- 
minal of the program code area in the step a8, it is pos- 
sible to obtain a check result coincident with the "ROM 
check result" in the memory map shown in Fig. 2. 
[0061] Next, in step a4, it is determined whether the 
one now read out is any one of A: secret code position 
information, B: program area information, D: a user se- 
cret key, and E: a ROM check result. Those are embed- 
ded in the external program in the form that they are 
encoded. And thus, in the event that the one now read 
out is any one of those items, a decoding is performed 
as to the read out contents (step a5). The decoding in 
the step a5 is performed using a key which is previously 
stored in the ROM 1 1 2 provided inside the LSI chip 1 1 0. 
This key have nothing to do with the "user secret key" 
shown in Fig. 2. 

[0062] The data thus decoded and C: user code (step 
a6) are saved inside, and access for the flash ROM 131 
is performed no longer until the power supply turns on 
again to execute the program shown in Fig. 3. The rea- 
son why this is to do so is that permission of the access 
for a plurality of number of times will give a hint to an 
unfair decoder (person). 

[0063] When the above-mentioned steps are sequen- 
tially performed from the first address of the flash ROM 
131 to the last address of the program code shown in 
Fig. 2 (step a8), the check results obtained and integrat- 
ed in the step a3 and the ROM check result encoded 
shown in Fig. 2 are read out and decoded so that the 
check results thus obtained are referred to each other 
(step a9). As a result, when it is decided that both the 
check results are coincident with one another (step 
a1 0), there is provided a state that a start of the external 
program stored in the flash ROM 131 is permitted, for 
example, in such a manner that an access permission 
flag for permitting an access of the flash ROM 131 is 
established (step a1 1 ). On the other hand, when it is de- 
cided that both the check results are not coincident with 
one another (step a10), there is provided a state that a 
start of the external program stored in the flash ROM 
131 is inhibited, for example, in such a manner that an 
access permission flag for permitting an access of the 
flash ROM 131 is turned off (step a12), so that the op- 
eration mode is switched to a mode in which the CPU 
111 performs only execution of the program stored in 
the ROM 112. 

[0064] According to the present embodiment, in the 
manner as mentioned above, validity of the external pro- 
gram stored in the flash ROM 131 is determined. 
[0065] Fig. 4 is a view showing a handling of a renewal 
module downloaded from a host system, and a memory 
map of an external program renewed by the renewal 
module. 

[0066] The flash ROM 131 shown in Fig. 1 already 



stores the external program, and it has been confirmed 
by the algorithm explained referring to Fig. 2 and 3 that 
the external program is proper. A renewal module now 
down loaded from the host system is one which is down 
5 loaded so as to renew a program to be renewed which 
is a part of the external program already stored in the 
flash ROM 1 31 . The renewal module down loaded is not 
immediately stored in the flash ROM 131, but temporar- 
ily stored in the RAM 132, and then after a decision ac- 
cording to the procedure which will be explained later, 
stored in the flash ROM 1 31 with replacement of the pro- 
gram to be renewed by the renewal module of the ex- 
ternal program stored in the flash ROM 131 . 
[0067] The renewal module down loaded from the 
host system comprises a new program code for per- 
forming a processing of the module and a module user 
code representative of a user of the renewal module, 
and is applied with a module check result. The module 
check result is information representative of a proper 
check result when the renewal module is checked using 
a predetermined check algorithm in the even that the 
renewal module is a proper renewal module. The mod- 
ule check result is applied to the renewal module in a 
state that it is encoded. 

[0068] Fig. 5 is a flowchart useful for understanding a 
module renewal program which is started when a re- 
newal module is down loaded and stored in the RAM 
132. Hereinafter, the explanation will be continued re- 
ferring to Fig. 5 together with Fig. 4. A module renewal 
program shown in Fig. 5 is stored in the ROM 112 pro- 
vided inside the LSI chip 1 1 0 shown in Fig. 1 . This mod- 
ule renewal program shown in Fig. 5 is an embodiment 
of a program renewal method of the present invention, 
and corresponds to an embodiment of a second 
processing apparatus of the present invention in com- 
bination with the hardware shown in Fig, 1 . 
[0069] When a renewal program is down loaded from 
the host system (cf.® of Fig. 4) , the down loaded re- 
newal program is temporarily stored in the RAM 132 
shown in Fig. 1 , and then the module renewal program 
shown in Fig. 5 starts. 

[0070] In the module renewal program shown in Fig. 
5, first, a module user code of a renewal module is com- 
pared with a user code (cf. Fig. 2) of the external pro- 
gram stored in the flash ROM 131 , which is an object to 
be renewed, and it is decided whether they are coinci- 
dent with one another. 

[0071 ] When it is decided that they are not coincident 
with one another, the validity decision processing is per- 
formed no longer with respect to the renewal program, 
and also it is not performed that the renewal program is 
written into the flash ROM 1 31 . Thus the process passes 
through the flow. That is, the renewal program is dis- 
carded. 

[0072] As a result of a decision of step b1 , when it is 
decided that the module user code and the user code 
are coincident with one another, arithmetic operation 
and check for determination of the following validity are 
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performed (cf.@ of Fig. 4). 

[0073] That is, the "module check result" of the renew- 
al program is applied to the renewal program in a state 
that it is encoded. Thus, the decoding of the module 
check result is performed (step b2). To perform the de- s 
coding of the module check result, the "user secret key" 
in the external program stored in the flash ROM 131 is 
used. The "user secret key" in the external program is 
one encoded. On the other hand, the "user secret key" , 
which is used for decoding the "module check result", is 10 
decoded in step b5 of the program check program 
shown in Fig. 3 for determining validity of the external 
program and is saved in a state that it is decoded. 
[0074] In the step b2 of the program of Fig. 5, the 
"module check result" is decoded by the "user secret *5 
key" in a state that it is decoded. 
[0075] Next, the renewal module is checked in ac- 
cordance with a predetermined check algorithm (step 
b3), so that a check result thus obtained is compared 
with a check result obtained through decoding of the 20 
"module check result' (step b4). 
[0076] When those check results are not coincident 
with one another (step b5), in a similar fashion to a case 
where in the step b1 it is decided that the module user 
code and the user code are not coincident with one an- 25 
other, the renewal module is not adopted and is discard- 
ed. 

[0077] On the other hand, in the step b5 when it is 
decided that those check results are coincident with one 
another, the process goes to step b6 in which a compu- 30 
tation of correction data is performed. 
[0078] It is assumed that the correction data is, as 
shown in @ of Fig. 4, one in which a predetermined 
module to be renewed of the external program stored in 
the flash ROM 131 is replaced by a renewal module (a 35 
new program code and a module user code) and cor- 
rection data which are stored in the flash ROM 131. The 
correction data is determined by an inverse operation 
according to the renewal module and the "ROM check 
result" in a state that it is decoded in such a mannerthat 40 
a check result, in a case where the external program 
renewed in accordance with the flow of Fig. 3 is checked 
from the top of the header to one (the terminal of the 
program code) immediately before an user data area in 
a predetermined algorithm, is coincident with the "ROM 45 
check result" embedded in the external program (since 
the "ROM check result" in the external program is en- 
coded, here, the "ROM check result" decoded in the 
step a5 in Fig. 3). 

[0079] When a computation of the correction data ac- 50 
cording to the inverse operation is performed, the re- 
newal module including the computed correction data is 
stored instead of the program to be renewed which is to 
be replaced by the present renewal module, of the ex- 
ternal program stored in the flash ROM 131 . Hereinafter, 55 
the external program, which is replaced by the renewal 
program, Is executed. 

[0080] When the module to be renewed is replaced 



by a renewal module, the check result for the external 
program is changed. To cope with this, it is considered 
that when the module to be renewed is renewed into a 
renewal module, the "ROM check result" in the external 
program is rewritten. However, such a rewriting of the 
"ROM check result" needs a rewriting of the "ROM 
check result" every renewal. This is associated with a 
high possibility that a storage address of the "ROM 
check result" is known by an unfair decoder (person). 
[0081] On the contrary, according to the present em- 
bodiment, even if the renewal is performed, the "ROM 
check resulf is not changed, and thus this makes it dif- 
ficult to perform an unfair decoding. 
[0082] Incidentally, according to the present embodi- 
ment as mentioned above, a combination of the "new 
program code" and the "module user code" is stored in 
the flash ROM 1 31 in form of the renewal module. How- 
ever, it is acceptable that only the "new program code" 
is stored in the flash ROM 131 in form of the renewal 
module, or alternatively, it is acceptable that a combina- 
tion of the "new program code", the "module user code", 
and further the "module check result" is stored in the 
flash ROM 131 in form of the renewal module. The cor- 
rection data is varied in accordance with a selection be- 
tween those renewal modules. 
[0083] According to the present embodiment as men- 
tioned above, there is provided such a system arrange- 
ment that the flash ROM is detachably mounted so that 
the external program is rewritable. On the other hand, 
also In an arrangement In which non-rewritable ROM is 
detachably mounted, a program check method of the 
present invention and a first processing apparatus of the 
present invention can be applied. 
[0084] Further, according to the present embodiment 
as mentioned above, the renewal module is temporarily 
stored in the detachably mounted RAM, it is acceptable 
that the LSI chip 110 is provided with a RAM, and the 
RAM is adopted as a temporal storage place for the re- 
newal module. 

[0085] Furthermore, according to the present embod- 
iment as mentioned above, the memory which is loaded 
on the same LSI chip as the CPU is referred to as the 
"internal memory", and the memory which is detachably 
mounted on the exterior of the LSI chip is referred to as 
the "external memory". However, the "internal memory" 
and the "external memory" referred to in the present in- 
vention are not restricted to the above-mentioned con- 
cept. For example, even if it is concerned with a memory 
which is loaded on an LSI chip other than the LSI on 
which CPU is loaded, it is acceptable that a memory ex- 
isting within the same package is referred to as the "in- 
ternal memory", and a memory detachably mounted on 
the exterior of the package is referred to as the "external 
memory". Or alternatively, even if a package is different, 
it is acceptable that a memory, which exists together 
with CPU within a certain apparatus, is referred to as 
the "internal memory", and a memory, which is connect- 
ed to the exterior of the apparatus, is referred to as the 
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"external memory". 

[0086] Still further, there is no need for the present in- 
vention to make a distinction between the "internal 
memory" and the "external memory". The present inven- 
tion is applicable to a processing apparatus simply pro- 
vided with a "memory" without such a distinction. 
[0087] Still furthermore, according to the present em- 
bodiment as mentioned above, while it has been ex- 
plained that the detachably mounted flash ROM 131 
stores therein a program, it is acceptable that the flash 
ROM 131 stores therein data which is referred to with a 
program stored in the ROM 112 inside the LSI chip 110, 
and validity of the data and validity of the module con- 
sisting of renewal data when part of the data is renewed 
are determined. 

[0088] As mentioned above, according to the present 
invention, even if programs and data are stored in a 
memory, it is possible to protect the programs and data 
from an act of reverse engineering and the like by a third 
person and thereby obtaining a higher security as com- 
pared with the prior art. 

[0089] While the present invention has been de- 
scribed with reference to the particular illustrative em- 
bodiments, it is not to be restricted by those embodi- 
ments but only by the appended claims. It is to be ap- 
preciated that those skilled in the art can change or mod- 
ify the embodiments without departing from the scope 
of the present invention. 

[0090] Although the above description has referred to 
a program stored in a ROM or flash ROM, it will be ap- 
preciated that a computer program embodying the 
present invention need not be stored in a ROM or flash 
ROM and could, for example, be embodied in a signal 
such as a downloadable data signal provided from an 
Internet website. The appended claims are to be inter- 
preted as covering a computer program by itself, or as 
a record on a carrier, or as a signal, or in any other form. 



Claims 

1 . In a processing apparatus having a memory storing 
contents for performing a processing according to 
the contents stored in said memory, a contents 
check method of deciding validity of the contents 
stored in said memory, 

wherein the contents stored in said memory 
involve original check result information represent- 
ative of a check result associated with validity of the 
contents and original check result position informa- 
tion representative of a storage position of the orig- 
inal check result information, said contents check 
method comprising: 

a check step of checking the contents stored in 
said memory in accordance with a predeter- 
mined check algorithm to obtain a check result; 
and 



a comparison step of comparing the check re- 
sult obtained by said check step with a check 
result represented by the original check result 
information stored in a storage position indicat- 
5 ed by the original check result position informa- 

tion to decide validity of the contents stored in 
said memory. 

2. In a processing apparatus having an internal mem- 
10 ory storing internal contents wherein an external 

memory for storing external contents is detachably 
mounted on said processing apparatus, for per- 
forming a processing according to the internal con- 
tents stored in said internal memory and the exter- 
15 nal contents stored in said external memory, a con- 
tents check method of deciding validity of the exter- 
nal contents stored in said external memory, 

wherein the external contents stored in said 
external memory involve original check result infor- 
20 mation representative of a check result associated 
with validity of the external contents and original 
check result position information representative of 
a storage position of the original check result infor- 
mation, said contents check method comprising: 

25 

a check step of checking the external contents 
stored in said external memory in accordance 
with a predetermined check algorithm to obtain 
a check result; and 
30 a comparison step of comparing the check re- 

sult obtained by said check step with a check 
result represented by the original check result 
information stored in a storage position indicat- 
ed by the original check result position informa- 
35 tion to decide validity of the external contents 

stored in said external memory. 

3. A contents check method according to claim 2 
wherein the external contents stored in said exter- 

40 nal memory involve the original check result infor- 
mation and the original check result position infor- 
mation at least one of which is encoded, said con- 
tents check method further comprising: 

45 a decoding step of decoding one encoded of 

the original check result information and the 
original check result position information. 

4. A contents check method according to claim 2 
50 wherein the external contents stored in said exter- 
nal memory involve check area designation infor- 
mation, and 

said check step checks an check area desig- 
nated by the check area designation information of 
55 the external contents stored In said external mem- 
ory. 

5. A contents check method according to claim 4 
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wherein the external contents stored in said exter- 
nal memory involve the check area designation in- 
formation which is encoded, said contents check 
method further comprising: 

a decoding step of decoding the encoded 5 
check area designation information. 

6. In a processing apparatus having a memory storing 
contents for performing a processing according to 

the contents stored in said memory, a contents re- io 
newal method of renewing a module to be renewed, 
which is part of the contents stored in said memory, 
into a new renewal module, 

wherein the contents stored in said memory 
involve original check result information represent- is 
ative of a check result associated with validity of the 
contents and original module check result informa- 
tion representative of a check result associated with 
validity of the renewal module, said contents renew- 
al method comprising: 20 

a module check step of checking the renewal 
module in accordance with a predetermined 
check algorithm to obtain a check result; 
a comparison step of comparing the check re- 25 
suit obtained by said module check step with a 
check result represented by the original module 
check result information involved in the renewal 
module to decide validity of the renewal mod- 
ule; so 
a correction data producing step of producing 
correction data in such a manner that a check 
result, in a case where the contents stored in 
said memory after the module to be renewed of 
the contents stored in said memory is renewed 35 
into the renewal 'module involving correction 
data is checked in accordance with a predeter- 
mined algorithm, is coincident with the check 
result represented by the original check result 
information involved in the contents; and 40 
a module renewal step of renewing the module 
to be renewed of the contents stored in said 
memory into the renewal module involving the 
correction data produced in said correction da- 
ta producing step in a case where said module 45 
check step decides that the renewal module is 
proper. 

7. In a processing apparatus having an internal mem- 
ory storing internal contents wherein an external so 
memory for storing external contents is detachably 
mounted on said processing apparatus, for per- 
forming a processing according to the internal con- 
tents stored in said internal memory and the exter- 
nal contents stored in said external memory, a con- 55 
tents renewal method of renewing a module to be 
renewed, which is part of the contents stored in said 
external memory, into a new renewal module, 



wherein the contents stored in said external 
memory involve original check result information 
representative of a check result associated with va- 
lidity of the external contents and original module 
check result Information representative of a check 
result associated with validity of the renewal mod- 
ule, said contents renewal method comprising: 

a module check step of checking the renewal 
module in accordance with a predetermined 
check algorithm to obtain a check result; 
a comparison step of comparing the check re- 
sult obtained by said module check step with a 
check result represented by the original module 
check result information involved in the renewal 
module to decide validity of the renewal mod- 
ule; 

a correction data producing step of producing 
correction data in such a manner that a check 
result, in a case where the external contents 
stored in said external memory after the module 
to be renewed of the external contents stored 
in said external memory is renewed into the re- 
newal module involving correction data is 
checked in accordance with a predetermined 
algorithm, is coincident with the check result 
represented by the original check result infor- 
mation involved in the external contents; and 
a module renewal step of renewing the module 
to be renewed of the external contents stored 
in said external memory into the renewal mod- 
ule involving the correction data produced in 
said correction data producing step in a case 
where said module check step decides that the 
renewal module is proper. 

8. A contents renewal method according to claim 7 
wherein the renewal module involves the original 
module check result information which is encoded, 
said contents renewal method further comprising: 

a decoding step of decoding the encoded 
original module check result information. 

9. A contents renewal method according to claim 8 
wherein the external contents stored in said exter- 
nal memory involve a key for decoding the encoded 
original module check result information, and 

said decoding step decodes the encoded 
original module check result information by said 
key. 

10. A contents renewal method according to claim 9 
wherein the external contents stored in said exter- 
nal memory Involve the key which Is encoded, 

said decoding step decodes the encoded 
original module check result information with the 
key which is read from said external memory and is 
decoded. 
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11. A processing apparatus having a memory storing 
contents for performing a processing according to 
the contents stored in said memory, 

wherein the contents stored in said memory 
involve original check result information represent- 
ative of a check result associated with validity of the 
contents and original check result position informa- 
tion representative of a storage position of the orig- 
inal check result information, said processing appa- 
ratus comprising: 

a check section for checking the contents 
stored in said memory in accordance with a pre- 
determined check algorithm to obtain a check 
result; and 

a comparison section for comparing the check 
result obtained by said check section with a 
check result represented by the original check 
result information stored in a storage position 
indicated by the original check result position 
information to decide validity of the contents 
stored in said memory. 

12. A processing apparatus having an internal memory 
storing internal contents wherein an external mem- 
ory for storing external contents is detachably 
mounted on said processing apparatus, for per- 
forming a processing according to the internal con- 
tents stored in said internal memory and the exter- 
nal contents stored in said external memory, 

wherein the external contents stored in said 
external memory involve original check result infor- 
mation representative of a check result associated 
with validity of the external contents and original 
check result position information representative of 
a storage position of the original check result infor- 
mation, said processing apparatus comprising: 

a check section for checking the external con- 
tents stored in said external memory in accord- 
ance with a predetermined check algorithm to 
obtain a check result; and 
a comparison section for comparing the check 
result obtained by said check section with a 
check result represented by the original check 
result information stored in a storage position 
indicated by the original check result position 
information to decide validity of the external 
contents stored in said external memory. 

13. A processing apparatus according to claim 12 
wherein the external contents stored in said exter- 
nal memory involve the original check result infor- 
mation and the original check result position infor- 
mation at least one of which is encoded, said 
processing apparatus further comprising: 

a decoding section for decoding one encoded 



of the original check result Information and the 
original check result position information. 

14. A processing apparatus according to claim 12 
s wherein the external contents stored In said exter- 
nal memory involve check area designation infor- 
mation, and 

said check section checks an check area des- 
ignated by the check area designation information 
10 of the external contents stored in said external 
memory. 

15. A processing apparatus according to claim 14 
wherein the external contents stored in said exter- 

'5 nal memory involve the check area designation in- 
formation which is encoded, said processing appa- 
ratus further comprising: 

a decoding section for decoding the encoded 
check area designation information. 

20 

16. A processing apparatus having a memory storing 
contents for performing a processing according to 
the contents stored in said memory, 

wherein the contents stored in said memory 
25 involve original check result information represent- 
ative of a check result associated with validity of the 
contents, said processing apparatus comprising: 

a renewal module obtaining section for obtain- 
30 ing a renewal module involving original module 

check result information representative of a 
check result associated with validity of the re- 
newal module, said renewal module being to be 
substituted for a module to be renewed which 
35 is part of the contents stored in said memory; 

a module check section for checking the renew- 
al module obtained in said renewal module ob- 
taining section in accordance with a predeter- 
mined check algorithm to obtain a check result; 
40 a comparison section for comparing the check 

result obtained by said module check step with 
a check result represented by the original mod- 
ule check result information involved in the re- 
newal module to decide validity of the renewal 
45 module; 

a correction data producing section for produc- 
ing correction data in such a manner that a 
check result, in a case where the contents 
stored in said memory after the module to be 
so renewed of the contents stored in said memory 

is renewed into the renewal module involving 
correction data is checked in accordance with 
a predetermined algorithm, is coincident with 
the check result represented by the original 
55 check result Information involved in the con- 

tents; and 

a module renewal section for renewing the 
module to be renewed of the contents stored in 
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said memory into the renewal module involving 
the correction data produced in said correction 
data producing section in a case where said 
module check step decides that the renewal 
module is proper. 5 

17. A processing apparatus having an internal memory 
storing internal contents wherein an external mem- 
ory for storing externa! contents is detachably 
mounted on said processing apparatus, for per- 10 
forming a processing according to the internal con- 
tents stored in said internal memory and the exter- 
nal contents stored in said external memory, 

wherein the external contents stored in said 
external memory involve original check result infor- 15 
mation representative of a check result associated 
with validity of the external contents, said process- 
ing apparatus comprising: 

a renewal module obtaining section for obtain- 20 
ing a renewal module involving original module 
check result information representative of a 
check result associated with validity of the re- 
newal module, said renewal module being to be 
substituted for a module to be renewed which 25 
is part of the external contents stored in said 
memory; 

a module check section for checking the renew- 
al module in accordance with a predetermined 
check algorithm to obtain a check result; 30 
a comparison section for comparing the check 
result obtained by said module check section 
with a check result represented by the original 
module check result information involved in the 
renewal module to decide validity of the renew- 35 
al module; 

a correction data producing section for produc- 
ing correction data in such a manner that a 
check result, in a case where the external con- 
tents stored in said external memory after the *o 
module to be renewed of the external contents 
stored in said external memory is renewed into 
the renewal module involving correction data is 
checked in accordance with a predetermined 
algorithm, is coincident with the check result 45 
represented by the original check result infor- 
mation involved in the external contents; and 
a module renewal section for renewing the 
module to be renewed of the external contents 
stored in said external memory into the renewal so 
module involving the correction data produced 
in said correction data producing step In a case 
where said module check step decides that the 
renewal module is proper. 

55 

18. A processing apparatus according to claim 17 
wherein the renewal module involves the original 
module check result Information which is. encoded, 



said processing apparatus further comprising: 

a decoding section for decoding the encoded 
original module check result information. 

19. A processing apparatus according to claim 18 
wherein the external contents stored In said exter- 
nal memory involve a key for decoding the encoded 
original module check result information, and 

said decoding section decodes the encoded 
original module check result information by said 
key. 

20. A processing apparatus according to claim 19 
wherein the external contents stored in said exter- 
nal memory involve the key which is encoded, 

said decoding section decodes the encoded 
original module check result Information with the 
key which is read from said external memory and is 
decoded. 

21. A computer program which, when loaded into a 
computer, causes the computer to become 
processing apparatus as claimed in any one of 
claims 11 to 20. 

22. A computer program which, when run on a compu- 
ter, cause the computer to carry out a contents 
check method or a contents renewal method, as the 
case may be, as claimed in any one of claims 1 to 
10. 
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